CVE-2017-5412
published 2018-06-11CVE-2017-5412: A buffer overflow read during SVG filter color value operations, resulting in data exposure. This vulnerability affects Firefox < 52 and Thunderbird < 52.
PriorityP338high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EPSS
4.58%
90.5th percentile
A buffer overflow read during SVG filter color value operations, resulting in data exposure. This vulnerability affects Firefox < 52 and Thunderbird < 52.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 52.0-1 (sid) | firefox 52.0-1 (sid) |
| mozilla | firefox | < 52.0 | 52.0 |
| mozilla | firefox | >= 0 < 52.0+build2-0ubuntu0.14.04.1 | 52.0+build2-0ubuntu0.14.04.1 |
| mozilla | firefox | >= 0 < 52.0.2+build1-0ubuntu0.14.04.1 | 52.0.2+build1-0ubuntu0.14.04.1 |
| mozilla | firefox | >= 0 < 52.0+build2-0ubuntu0.16.04.1 | 52.0+build2-0ubuntu0.16.04.1 |
| mozilla | firefox | >= 0 < 52.0.2+build1-0ubuntu0.16.04.1 | 52.0.2+build1-0ubuntu0.16.04.1 |
| mozilla | firefox | >= unspecified < 52 | 52 |
| mozilla | thunderbird | < 52.0 | 52.0 |
| mozilla | thunderbird | >= unspecified < 52 | 52 |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-83r9-7w8h-jjf7: A buffer overflow read during SVG filter color value operations, resulting in data exposure
ghsa_unreviewed·2022-05-14
CVE-2017-5412 [HIGH] CWE-119 GHSA-83r9-7w8h-jjf7: A buffer overflow read during SVG filter color value operations, resulting in data exposure
A buffer overflow read during SVG filter color value operations, resulting in data exposure. This vulnerability affects Firefox < 52 and Thunderbird < 52.
OSV
firefox regression
osv·2017-03-30·CVSS 9.8
[CRITICAL] firefox regression
firefox regression
USN-3216-1 fixed vulnerabilities in Firefox. The update resulted in a
startup crash when Firefox is used with XRDP. This update fixes the
problem.
We apologize for the inconvenience.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to bypass same origin restrictions, obtain
sensitive information, spoof the addressbar, spoof the print dialog,
cause a denial of service via application crash or hang, or execute
arbitrary code. (CVE-2017-5398, CVE-2017-5399, CVE-2017-5400,
CVE-2017-5401, CVE-2017-5402, CVE-2017-5403, CVE-2017-5404, CVE-2017-5405,
CVE-2017-5406, CVE-2017-5407, CVE-2017-5408, CVE-2017-5410, CVE-2017-5412,
CVE-2017-541
OSV
firefox vulnerabilities
osv·2017-03-07·CVSS 9.8
CVE-2017-5398 [CRITICAL] firefox vulnerabilities
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to bypass same origin restrictions, obtain
sensitive information, spoof the addressbar, spoof the print dialog,
cause a denial of service via application crash or hang, or execute
arbitrary code. (CVE-2017-5398, CVE-2017-5399, CVE-2017-5400,
CVE-2017-5401, CVE-2017-5402, CVE-2017-5403, CVE-2017-5404, CVE-2017-5405,
CVE-2017-5406, CVE-2017-5407, CVE-2017-5408, CVE-2017-5410, CVE-2017-5412,
CVE-2017-5413, CVE-2017-5414, CVE-2017-5415, CVE-2017-5416, CVE-2017-5417,
CVE-2017-5418, CVE-2017-5419, CVE-2017-5420, CVE-2017-5421, CVE-2017-5422,
CVE-2017-5426, CVE-2017-5427)
OSV
CVE-2017-5412: A buffer overflow read during SVG filter color value operations, resulting in data exposure
osv·2017-03-07·CVSS 7.5
CVE-2017-5412 [HIGH] CVE-2017-5412: A buffer overflow read during SVG filter color value operations, resulting in data exposure
A buffer overflow read during SVG filter color value operations, resulting in data exposure. This vulnerability affects Firefox < 52 and Thunderbird < 52.
Ubuntu
Firefox regression
vendor_ubuntu·2017-03-30·CVSS 9.8
[CRITICAL] Firefox regression
Title: Firefox regression
Summary: USN-3216-1 introduced a regression in Firefox.
USN-3216-1 fixed vulnerabilities in Firefox. The update resulted in a
startup crash when Firefox is used with XRDP. This update fixes the
problem.
We apologize for the inconvenience.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to bypass same origin restrictions, obtain
sensitive information, spoof the addressbar, spoof the print dialog,
cause a denial of service via application crash or hang, or execute
arbitrary code. (CVE-2017-5398, CVE-2017-5399, CVE-2017-5400,
CVE-2017-5401, CVE-2017-5402, CVE-2017-5403, CVE-2017-5404, CVE-2017-5405,
CVE-2017-5406, CVE-2017
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2017-03-07·CVSS 9.8
CVE-2017-5398 [CRITICAL] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to bypass same origin restrictions, obtain
sensitive information, spoof the addressbar, spoof the print dialog,
cause a denial of service via application crash or hang, or execute
arbitrary code. (CVE-2017-5398, CVE-2017-5399, CVE-2017-5400,
CVE-2017-5401, CVE-2017-5402, CVE-2017-5403, CVE-2017-5404, CVE-2017-5405,
CVE-2017-5406, CVE-2017-5407, CVE-2017-5408, CVE-2017-5410, CVE-2017-5412,
CVE-2017-5413, CVE-2017-5414, CVE-2017-5415, CVE-2017-5416, CVE-2017-5417,
CVE-2017-5418, CVE-2017-5419, CVE
Debian
CVE-2017-5412: firefox - A buffer overflow read during SVG filter color value operations, resulting in da...
vendor_debian·2017·CVSS 7.5
CVE-2017-5412 [HIGH] CVE-2017-5412: firefox - A buffer overflow read during SVG filter color value operations, resulting in da...
A buffer overflow read during SVG filter color value operations, resulting in data exposure. This vulnerability affects Firefox < 52 and Thunderbird < 52.
Scope: local
sid: resolved (fixed in 52.0-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/96692http://www.securitytracker.com/id/1037966https://bugzilla.mozilla.org/show_bug.cgi?id=1328323https://www.mozilla.org/security/advisories/mfsa2017-05/https://www.mozilla.org/security/advisories/mfsa2017-09/http://www.securityfocus.com/bid/96692http://www.securitytracker.com/id/1037966https://bugzilla.mozilla.org/show_bug.cgi?id=1328323https://www.mozilla.org/security/advisories/mfsa2017-05/https://www.mozilla.org/security/advisories/mfsa2017-09/
2018-06-11
Published